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Abstract. This paper presents a formalized proof of a discrete form of the Jordan Curve 
Theorem. It is based on a hypermap model of planar subdivisions, formal specifications 
and proofs assisted by the Coq system. Fundamental properties are proven by structural 
or noetherian induction: Genus Theorem, Euler's Formula, constructive planarity criteria. 
A notion of ring of faces is inductively defined and a Jordan Curve Theorem is stated and 
proven for any planar hypermap. 



Introduction 

This paper presents a formal statement and an assisted proof of a Jordan Curve The- 
orem (JCT) discrete version. In its common form, the theorem says that the complement 
of a continuous simple closed curve (a Jordan curve) C in an affine real plane is made of 
two connected components whose border is C, one being bounded and the other not. The 
discrete form of JCT we deal with states that in a finite subdivision of the plane, breaking 
a ring R of faces increases by 1 the connectivity of the subdivision. It is a weakened version 
of the original theorem where the question of bound is missing. However, it is widely used 
in computational geometry and discrete geometry for imaging, where connection is the es- 
sential information In fact, we only are in a combinatoric framework, where any 
embedding is excluded, and where bounding does not make sense. 

In computational top olog y, subdivisions are best described by map models, the most 
general being hypermaps dla; Ij). We propose a purely combinatorial proof of JCT based 
on this structure. The hypermap framework is entirely formalized and the proofs are de- 
veloped interactively and verified by the Coq proof assistant (^). Using an original way 
to model, build and destruct hypermaps, the present work brings new simple constructive 
planarity and connectivity criteria. It proposes a new direct expression of JCT and a simple 
constructive proof with algorithmic extensions. It is also a large benchmark for the software 
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specification framework we have been developing in tlie last fifteen years for map models 
used in geometric modeling and computer imagery ([3; Q; @) • 

The useful Coq features are reminded and the whole process is described, but the full 
details of the proofs are omitted. Section [1] summarizes related work. Section [2] recalls some 
mathematical materials. Section [3] proposes basic hypermap specifications. Section Improves 
constructive criteria of hypermap planarity and connectivity. Section [5] inductively specifies 
the rings and their properties. Section [6] proves the discrete JCT. Section [7] concludes. 

1. Related work 

The JCT is a result of classical plane topology, first stated by C. Jordan in 1887, 
but of which O. Veblen gives the first correct proof in 1905. In 1979, W.T. Tutte proposes 
operations and properties of combinatorial maps, e.g. planarity and Euler's Formula, defines 
rings and proves a discrete JCT (0). Our theorem statement is comparable, but our 
framework is modeled differently and all our proofs are formalized and computer-assisted. 

In 2003, G. Bauer and T. Nipkow specify planar graphs and triangulations in Is- 
abelle/Isar to carry out interactive proofs of Euler's Formula and of the Five Colour The- 
orem IH). However, they do not approach the JCT. In 2005, A. Kornilowicz designs for 
the MIZAR project a semi-automated classical proof of a continuous form of JCT in an 
Euclidean space (0). In 2005 also, on his way towards the proof of the Kepler conjecture 
in the Flyspeck projet, T. Hales proves the JCT for planar rectangular grids with the HOL 
Light system, following the Kuratowski characterization of planarity (Il2l ). 

In 2005 always, G. Gonthier et al. prove the Four Colour Theorem using Coq. Plane 
subdivisions are described by hypermaps, and Euler's Formula is used as a global planarity 
criterion (fiol ). A local criterion, called hypermap Jordan property, is proven equivalent. The 
main part of this work is the gigantic proof of the Four Colour Theorem with hypermaps 
and sophisticated proof techniques. The hypermap formalization is very different from ours 
and it seems that JCT is not explicitly proven there. Finally, since 1999, we carry out 
experiments with Coq for combinatorial map models of space subdivisions (|B;0;[1)- 

2. Mathematical Aspects 

Definition 2.1 (Hypermap). A hypermap is an algebraic structure M = {D, ao,ai), where 
D is a finite set whose elements are called darts, and uq, ai are permutations on D. 

If y = ak{x), y is the k-successor of x, x is the k-predecessor of y, and x and y are said 
to be k-linked. 

In Fig. [H as functions oq and ai on D = {1, . . . , 15} are permutations, M = {D, uq, ai) 
is a hypermap. It is drawn on the plane by associating to each dart a curved arc oriented 
from a bullet to a small stroke: 0-linked (resp. 1-linked) darts share the same small stroke 
(resp. bullet). By convention, in the drawings of hypermaps on surfaces, A:-successors turn 
counterclockwise around strokes and bullets. Let M = (Z),ao,ai) be a hypermap. 

Definition 2.2. (Orbits and hypermap cells) 

(1) Let /i, ...,/„ be n functions in D. The orbit of x G D for /i, . . . , is the subset of D 
denoted by (/i, . . . , fn){x), the elements of which are accessible from x by any composition 

of /l,...,/n- 
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Figure 1: An example of hyper map. 

(2) In M, {ao){x) is the 0-orbit or edge of dart x, (ai)(x) its 1-orbit or vertex, {4>){x) its 
face for (j) = aj"^ o a^"^ , and {aQ,ai){x) its (connected) component. 

In Fig. [T]the hypermap contains 7 edges (strokes), 6 vertices (bullets), 6 faces and 3 
components. For instance, (q!o)(3) = {3,5,4} is the edge of dart 3, (ai)(3) = {3,4,1,2} its 
vertex. Faces are defined, through (/>, for a dart traversal in counterclockwise order, when 
the hypermap is drawn on a surface. Then, every face which encloses a bounded (resp. 
unbounded) region on its left is called internal (resp. external). In Fig. [H the (internal) 
face of 8 is ((A)(8) = {8,10} and the (external) face of 13 is ((/))(13) = {13}. Let d,e,v,f 
and c be the numbers of darts, edges, vertices, faces and components of M. 

Definition 2.3. (Euler characteristic, genus, planarity) 

(1) The Euler characteristic M is x = v + e + f — d. 

(2) The genus of M is g = c — x/2- 

(3) When g = 0, M is said to be planar. 

For instance, in Fig. [Tlx = 6 + 6 + 7 — 15 = 4 and g = 3 — x/2 = 1. Consequently, the 
hypermap is non planar. These values satisfy the following results: 

Theorem 2.4 (of the Genus), x ^-^ even integer and g is a natural number. 

Corollary 2.5 (Euler Formula). A non empty connected — i.e. with c = 1 — planar 
hypermap satisfies v + e + f — d = 2. 

When 7^ 0, the representation of M on an orientable closed surface is a mapping of 
edges and vertices onto points, darts onto open oriented Jordan arcs, and faces onto open 
connected regions. It is an embedding when every component of M realizes a partition of 
the surface. Then, the genus of M is the minimum number of holes in an orientable closed 
surface where such an embedding is possible, thus drawing a subdivision, or a polyhedron, 
by hypermap component (11). For instance, all the components of the hypermap in Fig. [T] 
can be embedded on a torus (1 hole) but not on a sphere or on a plane (0 hole). When a 
(planar) hypermap component is embedded on a plane, the corresponding subdivision has 
exactly one unbounded (external) face. But a non planar hypermap can never be embedded 
on a plane: in a drawing on a plane, some of its faces are neither internal nor external, e.g. 
((/>)(1) = {1,5,2,11,12,7,6,4,9} in Fig. [H Conversely, any subdivision of an orientable 
closed surface can be modeled by a hypermap. In fact, the formal presentation which 
follows is purely combinatorial, i.e without any topological or geometrical consideration. 

2.1. Rings of faces and Jordan Curve Theorem 

To state the version of JCT we will prove, we need the concepts of double-link, adjacent 
faces and ring of faces in a hypermap M = (D, ao, ai). 
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Figure 2: Break of M along a ring R of length n = 4 giving M' . 
Definition 2.6. (Double-link and adjacent faces) 

(1) A double-link is a pair of darts (y, y') where y and y' belong to the same edge. 

(2) The faces F and F' of M are said to be adjacent by the double-link (y, y') if y is a dart 
of F and y' a dart of F' . 

We choose a face adjacency by an edge rather than by a vertex as does W.T. Tutte (0). 
In fact, due to the homogeneity of dimensions and 1 in a hypermap, both are equivalent. 

Definition 2.7. (Ring of faces) 

A ring of faces R of length n in M is a non empty sequence of double- links (yi,y'-), for 
i = 1, . . . , n, with the following properties, where Ei and Fi are the edge and face of 

(0) Unicity: Ei and Ej are distinct, for i,j = 1, . . . , n and i ^ j; 

(1) Continuity: Fi and -Fj+i are adjacent by the double-link (yj, y'-), for i = 1, . . . , n — 1; 

(2) Circularity, or closure: En and Fi are adjacent by the double-link {yn,y'n)'i 

(3) Simplicity: Fi and Fj are distinct, for i,j = 1, . . . , n and i ^ j. 

This notion simulates a Jordan curve represented in dotted lines in Fig. [2] on the left 
for n = 4. Then, we define the break along a ring, illustrated in Fig. [2] on the right. 

Definition 2.8. (Break along a ring) 

Let -R be a ring of faces of length n in M. Let Mi = {D, ao.ii ^i), for i = 0, . . . , n, be a 
hypermap sequence, where the ao,i are recursively defined by: 

(1) i = 0: ao,o = ao; 

(2) 1 < i < n: for each dart z of D: ao,i(-z) = if ao,j-i(-2) = yi then y[ else if ao,i-i(^;) = y'i 
then T/j else ao,i-i(-2)- 

Then, M„ = (D, ao,n) oi) is said to be obtained from M by a break along R. 

Finally, the theorem we will prove in Coq mimics the behaviour of a cut along a simple 
Jordan curve of the plane (or of the sphere) into two components: 

Theorem 2.9 (Discrete Jordan Curve Theorem). Let M be a planar hypermap with c 
components, R be a ring of faces in M , and M' be the break of M along R. The number d 
of components of M' is such that c' = c + 1. 

3. Hypermap specifications 

3.1. Preliminary specifications 

In Coq, we first define an inductive type dim for the two dimensions at stake: 
Inductive dim: Set := zero: dim | one: dim. 
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Figure 3: A hypermap with its incompletely linked orbits. 



All objects being typed in Coq, dim has the type Set of all concrete types. Its constructors 
are the constants zero and one. In each inductive type, the generic equality predicate = is 
built-in but its decidability is not, because Coq's logic is intuitionistic. For dim, the latter 
can be established as the lemma: 

Lemma eq_dim_dec: forall i j : dim, {i=j}+{~i=j} . 

Once it is made, its proof is an object of the sum type {i=j }+{~i=j }, i-e. a function, named 
eq_dim_dec, that tests whenever its two arguments are equal. The lemma is interactively 
proven with some tactics, the reasoning being merely a structural induction on both i and 
j, here a simple case analysis. Indeed, from each inductive type definition, Coq generates 
an induction principle, usable either to prove propositions or to build total functions on the 
type. We identify the type dart and its equality decidability eq_dart_dec with the built-in 
nat and eq_nat_dec. Finally, to manage exceptions, a nil dart is a renaming of 0: 

Definition dart:= nat. 

Definition eq_dart_dec : = eq_nat_dec. 

Definition nil:= 0. 

3.2. Free maps 

The hypermaps are now approached by a general notion of free map, thanks to a free 
algebra of terms of inductive type f map with 3 constructors, V, I and L, respectively for the 
empty (or void) map, the insertion of a dart, and the linking of two darts: 
Inductive fmap:Set:= 

V : fmap | I : fmap->dart->fmap | L : fmap->dim->dart->dart->fmap . 

For instance, the hypermap in Fig. [1] can be modeled by the free map represented in Figl3] 
where the 0- and 1-links by L are represented by arcs of circle, and where the orbits remain 
open. Again, Coq generates an induction principle on free maps. 

Next, observers of free maps can be defined. The predicate exd express that a dart 
exists in a hypermap. Its definition is recursive, which is indicated by Fixpoint, thanks 
to a pattern matching on m written match m with. . .. The attribute {struct m} allows 
Coq to verify that the recursive calls are performed on smaller fmap terms, thus ensuring 
termination. The result is False or True, basic constants of Prop, the built-in type of 
propositions. Note that terms are in prefix notation and that _ is a place holder: 
Fixpoint exd (m: fmap) (z: dart) {struct m}:Prop:= 
match m with 

V => False | I mO x => z=x \/ exd mO z | L mO _ _ _ => exd mO z 
end. 
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The decidability exd_dec of exd directly derives, thanks to a proof by induction on m. Then, 
a version, denoted A, of operation of Definition 12.11 completed with nil for convenience 
is written as follows, the inverse A_l being similar: 

Fixpoint A (m :f map) (k: dim) (z: dart) {struct m}:dart:= 
match m with 

V => nil I I mO X => A mO k z | L mO kO x y => 

if eq_dim_dec k kO then if eq_dart_dec z x then y else A mO k z 
else A mO k z 

end. 

Predicates succ and pred express that a dart has a k-successor and a k-predecessor (not 
nil), with the decidabilities succ_dec and pred_dec. In hypermap m of Fig. [3l A m zero 4 
= 3, A m zero 5 = nil, succ m zero 4 = True, succ m zero 5 = False, A_l m one 
2 = 1. In fact, when a k-orbit remains open, which will be required in the following, we 
can obtain its top and bottom from one of its dart z. Then, we can do as if the k-orbit 
were closed, thanks to the operations cA and cA_l which close A and A_l, in a way similar 
to operation K of W.T. Tutte (jTH). For instance, in Fig. [3l top m one 1=3, bottom m 
one 1=4, cA m one 3=4, cA_l m one 4=3. 

Finally, destructors are also recursively defined. First, D : fmap->dart->fmap deletes 
the latest insertion of a dart by I. Second, B, B_: fmap->dim->dart->fmap break the latest 
k-link inserted for a dart by L, forward and backward respectively. 

3.3. Hypermaps 

Preconditions written as predicates are introduced for I and L: 
Definition prec_I (m:f map) (x: dart) := x <> nil /\ ~ exd m x. 
Definition prec_L(m:fmap) (k:dim) (x y:dart):= 
exd m X /\ exd m y /\ ~ succ m k x /\ ~ pred m k y /\ cA m k x <> y. 
If I and L are used under these conditions, the free map built necessarily has open orbits. 
In fact, thanks to the closures cA and cA_l, it can always be considered as a true hypermap 
exactly equipped with operations ak of Definition 12. 1[ It satisfies the invariant: 
Fixpoint inv_hmap (m : f map) : Prop : = 
match m with 

V => True | I mO x => inv_hmap mO /\ prec_I mO x 
I L mO kO X y => inv_hmap mO /\ prec_L mO kO x y 
end. 

Such a hypermap was already drawn in Fig. [3l Fundamental proven properties are that, 
for any m and k, (A m k) and (A_l m k) are injections inverse of each other, and (cA m k) 
and (cA_l m k) are permutations inverse of each other, and are closures. Finally, traversals 
of faces are based on function F and its closure cF, which correspond to (p (Definition 12. 2p . 
So, in Fig. [3l F m 1 = nil, cF m 1 = 5. Properties similar to the ones of A, cA are proven 
for F, cF and their inverses F_l, cF_l. 

3.4. Orbits 

Testing if there exists a path from a dart to another in an orbit for a hypermap permu- 
tation is of prime importance, for instance to determine the number of orbits. The problem 
is exactly the same for oq, ai or (p (Definitions 12.11 and 12. 2p . That is why a signature Sigf 
with formal parameters f , f_l and their properties is first defined. 
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L m zero x y m L m zero x y 

Planar 0-linking inside a face F giving 2 faces F' and F' ' . Non planar 0-linlcing between 2 faces F and F' giving face F" . 



Figure 4: Linking at dimension 0. 

Next, a generic module (or functor) Mf (M : Sigf ) , the formal parameter M being a module 
of type Sigf, is written in Coq to package generic definitions and proven properties about 
f and f _1. Among them, we have that each f -orbit of m is periodic with a positive smallest 
uniform period for any dart z of the orbit. The predicate expo m z t asserts the existence 
of a path in an f -orbit of m from a dart z to another t, which is proven to be a decidahle 
equivalence. Note that most of the properties are obtained by noetherian induction on the 
length of iterated sequences of f-successors, bounded by the period. 

Appropriate modules, called MAO, MAI and MF, are written to instantiate for (cA m 
zero), (cA m one) and (cF m) definitions and properties of f. So, a generic definition or 
property in Mf (M) has to be prefixed by the module name to be concretely applied. For 
instance, MF.expo m z t is the existence of a path from z to t in a face. In the following, 
MF.expo is abbreviated into expf. For instance, in Fig. [3l expf m 1 5 = True, expf m 
5 3 = False. Finally, a binary relation eqc stating that two darts belong to the same 
component is easily defined by induction. For instance, in Fig. [3l we have eqc m 1 5 = 
True, eqc m 1 13 = False. We quickly prove that (eqc m) is a decidahle equivalence. 

3.5. Characteristics, Genus Theorem and Euler Formula 

We now count cells and components of a hypermap using the Coq library module ZArith 
containing all the features of Z, the integer ring, including tools to solve linear systems in 
Presburger's arithmetics. The numbers nd, ne, nv, nf and nc of darts, edges, vertices, faces 
and components are easily defined by induction. Euler 's characteristic ec and genus derive. 
The Genus Theorem and the Euler Formula (for any number (nc m) of components) are 
obtained as corollaries of the fact that ec is even and satisfies 2 * (nc m) >= (ec m) 
Remark that -> denotes a functional type in Set as well as an implication in Prop: 

Definition ec(m:fmap) : Z:= nv m + ne m + nf m - nd m. 

Definition genus (m:f map) : Z:= (nc m) - (ec m)/2. 

Definition planar (m: f map) : Prop:= genus m = 0. 

Theorem Genus_Theorem: forall m:fmap, inv_hmap m -> genus m >= 0. 
Theorem Euler_Formula: forall m:fmap, inv_hmap m -> planar m -> 
ec m / 2 = nc m. 

4. Planarity and connectivity criteria 

A consequence of the previous theorems is a completely constructive criterion of pla- 
narity, when one correctly links with L at dimensions or 1, e.g. for 0: 
Theorem planarity_crit_0 : forall (m:fmap)(x y:dart), 

inv_hmap m -> prec_L m zero x y -> (planar (L m zero x y) <-> 
(planar m /\ (~ eqc m x y \/ expf m (cA_l m one x) y))). 
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a. Double-link coded by (x, true) ; face F contains y. b. Double-link coded by (x, false) : face F contains xO. 

Figure 5: Coding a double-link and identifying a face. 

So, the planarity of m is preserved for (L m zero x y) ijff one of the following two conditions 
holds: (1) X and y are not in the same component of m; (2) x_l = (cA_l m one x) and 
y are in the same face of m, i.e. the linking operates inside the face containing y. Fig. d] 
illustrates 0-linking inside a face, giving two new faces, and between two (connected) faces, 
giving a new face, thus destroying planarity. Finally, after a long development, we prove 
the expected planarity criterion, when breaking a link with B, at any dimension, e.g. for 0: 

Lemma planarity_crit_BO : forall (m:fmap) (x:dart) , inv_hmap m -> 

succ m zero x -> let mO := B m zero x in let y := A m zero x in 
(planar m <-> (planar mO /\ (~ eqc mO x y \/ expf mO (cA_l mO one x) y) ) ) . 
Such a lemma is easy to write/understand as a mirror form of the 0-linking criterion, but it 
is much more difficult to obtain. It would be fruitful to relate these constructive/destructive 
criteria with the static one of G. Gonthier Finally, some useful results quickly char- 

acterize the effect of a link break on the connectivity of a planar hypermap. For instance, 
when 0-breaking x, a disconnection occurs iff expf m y xO: 

Lemma disconnect_planar_criterion_BO: forall (m:fmap) (x:dart) , 
inv_hmap m -> planar m -> succ m zero x -> 

let y := A m zero x in let xO := bottom m zero x in 
(expf m y xO <-> "eqc (B m zero x) x y) . 

5. Rings of faces 

5.1. Coding a double-links and identifying a face 

Since an edge is always open in our specification, when doing the backward break of a 
unique 0-link from y or y ' , we in fact realize a double-link break, as in Definition 12.81 So, 
we choose to identify a double-link by the unique dart, we called x, where the 0-link to be 
broken begins. In fact, with respect to the face F on the left of the double-link in the ring, 
there are two cases, depending on the position of x and its forward 0-link, as shown in Fig. 
[5] (a) and (b). We decided to distinguish them by a Boolean b. Then, a double-link is coded 
by a pair (x, b). So, we implicitely identify each ring face F by the double-link coding on 
its right in the ring. In Fig. [5] (a), face F is identified by (x, true) and contains y:= A m 
zero X, whereas in Fig. [5](b), face F is identified by (x, false) and contains xO:= bottom 
m zero x. These modeling choices considerably simplify the problems. Indeed, in closed 
orbits, a true double- link break would entail 2 applications of B followed by 2 applications 
of L, and would be much more complicated to deal with in proofs. 
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5.2. Modeling a ring of faces 

First, we inductively define linear lists of pairs of booleans and darts, with the two 
classical constructors lam and cons, and usual observers and destructors, which we do not 
give, because their effect is directly comprehensible: 

Inductive list: Set := lam: list | cons: dart*bool -> list -> list. 
Such a list is composed of couples (x, b), each identifying a face F: if b is true, F is 
represented by y:= A m zero x, otherwise by xO:= bottom m zero x (Fig. [5|). In the 
following, Bl m 1 breaks all the 0-links starting from the darts of list 1 in a hypermap 
m. Now, we have to model the conditions required for list 1 to be a ring of hypermap m. 
Translating Definition 12.71 we have four conditions, called pre_ringk m 1, for k = 0, . . . , 3, 
which we explain in the following sections. Finally, a predicate ring is defined by: 

Definition ring(m:fmap) (l:list) :Prop:= ~emptyl 1 /\ 

pre_ringO m 1 /\ pre_ringl m 1 /\ pre_ring2 m 1 /\ pre_ring3 m 1. 

5.3. Ring Condition (0): unicity 

The predicate distinct_edge_list m x 10 saying that the edges of 10 are distinct in 
m from a given edge of x, pre_ringO m 1 is defined recursively on 1 to impose that all edges 
in 1 are distinct: Condition (0) of Definition 12.71 It also imposes that each dart in 1 has 
a 0-successor, in order to have well defined links, which is implicit in the mathematical 
definition, but not in our specification whith open orbits. 

Fixpoint pre_ringO (m:f map) (1: list) {struct l}:Prop:= 
match 1 with 

lam => True | cons (x,_) 10 => 

pre_ringO m 10 /\ distinct_edge_list m x 10 /\ succ m zero x 

end. 

5.4. Ring Condition (1): continuity 

Then, we define adjacency between two faces identified by xb = (x, b) and xb' = 
(x ' , b ' ) , along the link corresponding to xb: 
Definition adj acent_f aces (m:f map) (xb xb' :dart*bool) := 
match xb with (x,b) => match xb' with (x',b') => 
let y := A m zero x in let y' := A m zero x' in 
let xO := bottom m zero x in let x'0:= bottom m zero x' in 
if eq_bool_dec b true 

then if eq_bool_dec b' true then expf m xO y' else expf m xO x'O 
else if eq_bool_dec b' true then expf m y y' else expf m y x'O 
end end. 

This definition is illustrated in Fig. [6] for the four possible cases of double-link codings. 
So, the predicate prejringl m 1 recursively specifies that two successive faces in 1 are 
adjacent: Condition (1) in Definition 12.71 

Fixpoint pre_ringl (m:f map) (1: list) {struct l}:Prop:= 
match 1 with 
lam => True | cons xb 10 => pre_ringl m 10 /\ 

match 10 with lam => True | cons xb' 1' => adj acent_f aces m xb xb' end 
end. 
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Figure 6: Four cases of face adjacency. 

5.5. Ring Condition (2): circularity, or closure 

The predicate pre_ring2 m 1 specifies that the last and first faces in 1 are adjacent: 
Condition (2) of circularity in Definition 12. 7t 

Definition pre_ring2(m:fmap) (l:list) :Prop:= 
match 1 with 

lam => True | cons xb 10 => 
match xb with (x,b) => let y := A m zero x in match 10 with 

lam => let xO := bottom m zero x in expf m y xO 
I cons _ 1' => let xb' := last 10 in adjacent_f aces m xb' xb 
end end 

end. 

5.6. Ring Condition (3): simplicity 

The predicate specifiying that the faces of m identified by xb and xb' are distinct is 
easy to write by cases on the Booleans in xb and xb'. The predicate distinctJ ace_list 
m xb 10 expressing that the face identified by xb is distinct from all faces of list 10 entails. 
Then, the predicate pre_ring3 m 1 says that all faces of 1 are distinct: Condition (3) in 
Definition [221 

Fixpoint pre_ring3(m: fmap) (1 : list){struct l}:Prop:= 
match 1 with 

lam => True | cons xb 10 => pre_ring3 m 10 /\ distinct_f ace_list m xb 10 
end. 

6. Discrete Jordan Curve Theorem 

The general principle of the JCT proof for a hypermap m and a ring 1 is a structural 
induction on 1. The case where 1 is empty is immediatly excluded because 1 is not a ring 
by definition. Thus the true first case is when 1 is reduced to one element^ i.e. is of the 
form cons (x, b) lam. Then, we prove the following lemma as a direct consequence of the 
planarity criterion planarity_crit_BO and the criterion f ace_cut_join_criterion_BO: 
Lemma Jordanl : forall (m: fmap) (x: dart) (b :bool) , inv_hmap m -> planar m -> 
let 1:= cons (x,b) lam in ring m 1 -> nc (Bl ml) = nc m + 1. 
When a ring 11 contains at least two elements, we prove that the condition ~expf m y 
xO must hold with the first element (x,b) of 11 (in fact, conditions (1) and (3) are enough): 
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Lemma riiigl_ring3_connect : 
f orall(m:fmap) (x x':dart)(b b' :bool) (1 : list) , inv_hmap m -> 
let 11:= cons (x,b) (cons (x',b') 1) in 
let y:=A m zero x in let xO:= bottom m zero x in 

planar m -> pre_ringl m 11 -> pre_ring3 m 11 -> "expf m y xO. 
In this case, thanks to disconnect_planar_criterionJO (Section H]), the lemma entails 
that the break of the first ring link does never disconnect the hypermap. Then, after 
examining the behavior of pre_ringk, for k = 0, . . . , 3, we are able to prove the following 
lemma which states that the four ring properties are preserved after the first break in 1: 
Lemma pre_ring_B: f orall (m: fmap) (1 : list) , inv_hmap m -> planar m -> 
let X := fst (first 1) in let y := A m zero x in 
let xO := bottom m zero x in let ml := B m zero x in 
"expf m y xO -> ring m 1 -> (pre_ringO ml (tail 1) /\ pre_ringl ml (tail 1) 
/\ pre_ring2 ml (tail 1) /\ pre_ring3 ml (tail 1)). 
The most difficult is to prove the part of the result concerning pre_ringk, for k = 0, . . . , 3. 
The four proofs are led by induction on 1 in separate lemmas. For pre_ringO, the proof is 
rather simple. But, for the other three, the core is a long reasoning where 2, 3 or 4 links are 
involved in input. Since each link contains a Boolean, sometimes appearing also in output, 
until 2^ = 16 cases are to be considered to combine the Boolean values. 

Finally, from Jordanl and pre_ring_B above, we have the expected result by a quick 
reasoning by induction on 1, where links are broken one by one from the first: 
Theorem Jordan: f orall (1 : list) (m: fmap) , 

inv_hmap m -> planar m -> ring m 1 -> nc (Bl ml) = nc m + 1. 

It is clear that, provided a mathematical hypermap M and a mathematical ring R conform to 
Definitions 12.11 and 12 . 71 we can always describe them as terms of our specification framework 
in order to apply our JCT. Conversely, given a hypermap term, some mathematical rings 
cannot directly be written as terms. To do it, our ring description and our JCT proof have 
to be slightly extended. However, that is not necessary for the combinatorial maps (where 
ao is an involution) terms, for which our ring specification and our JCT formalization are 
complete. This is more than enough to affirm the value of our results. 

7. Conclusion 

We have presented a new discrete statement of the JCT based on hypermaps and 
rings, and a formalized proof assisted by the Coq system. Our hypermap modeling with 
open orbits simplifies and precises most of known facts. It also allows to obtain some new 
results, particularly about hypermap construction/destruction, connection/disconnection 
and planarity. This work involves a substantial framework of hypermap specification, which 
is built from scratchy i.e. exempt from any proper axiom. It is basically the same as the 
one we have designed to develop geometric modelers via algebraic specifications So, we 
know how to efficiently implement all the notions we formally deal with. 

The Coq system turned out to be a precious auxiliary to guide and check all the process 
of specification and proof. The preexistent framework of hypermap specification represents 
about 15,000 lines of Coq, and the JCT development about 5,000 lines, including about 25 
new definitions, and 400 lemmas and theorems. Note that all results about the dimension 
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were actually proven, but some planarity properties about dimension 1, which are perfectly 
symmetrical, have just been admitted. However, the JCT formal proof is complete. 

So, we have a solid foundation to tackle any topological problem involving orientable 
surface subdivisions. Extensions are in 2D or 3D computational geometry and geometric 
modeling by introducing embeddings (@; [2), and computer imagery by dealing with pixels 
(0) or voxels. 
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